Tenant isolation
Each customer's data is logically isolated, with dedicated deployments available in your own cloud account.
- Home
- Platform
- Security & trust
Trust is a feature. We built it in.
Master data is the most sensitive data you own. Isolation, access control, encryption and audit are part of the core architecture, and we tell you exactly what has and has not been independently verified.
Secure by designControls in the core, not add-ons
Honest statusNo badges we haven't earned
Architecture
Layered defence. Zero shortcuts.
Every request, whether from a person, an application or an AI agent, passes through the same identity, policy, masking and audit layers before it touches a golden record.
- One policy engine for people, apps and agents
- Field-level masking for sensitive attributes
- Immutable, attributable audit trail
Security layersby design
Tenant isolationper tenant
SSO + role-based accessRBAC
Encryption in transit & at restTLS · AES
Audit log on every read & writeimmutable
Data residency by regionUS · UK · EU · UAE
Controls
Six controls. Every deployment.
Identity & access
SSO, role-based access control and least-privilege defaults for people, apps and AI agents.
Encryption
TLS in transit and encryption at rest, with customer-managed keys on the roadmap.
Audit logging
Every read, write, merge and steward decision is logged and attributable.
Data residency
Choose where data lives: US, UK, EU or UAE regions, or keep it in your own VPC.
Backup & recovery
Documented backup, restore and recovery posture, reviewed during every pilot scope.
Deployment
Your cloud. Our cloud. Your call.
Deployment boundaries are agreed in writing during pilot scoping.
Deployment optionsRun where it makes sense for your business
AWS
Microsoft Azure
Hybrid
On-premises
Customer VPC
Verification status
What's verified. What isn't. Yet.
We do not display certification badges we have not earned.
| Framework | Status | What that means |
|---|---|---|
| SOC 2 Type II | Planned | Controls are being designed with SOC 2 in mind. No report has been issued yet. |
| ISO/IEC 27001 | Planned | On the roadmap after SOC 2. Not certified today. |
| Independent penetration test | Planned | Scheduled before general availability. Summary available under NDA once complete. |
| GDPR and UK GDPR | By design | Data processing agreement, data-subject request support and regional residency. |
| CCPA / CPRA | By design | Record lineage makes access and deletion requests traceable across sources. |
| HIPAA | Per engagement | Assessed case by case. We will tell you plainly if a requirement cannot be met. |
Found a vulnerability? Tell us first.
Email security@inaferadata.com with details and steps to reproduce. We will acknowledge your report, keep you updated and credit you if you wish. Please do not access or modify other people's data while testing.
Report an issueWe don't want your secrets.
- Never paste credentials, tokens or raw customer records into our forms
- Form submissions are encrypted in transit
- Investor and prospect data are stored separately with restricted access